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Case ID #: 


Title: UNSUB(S), 
UGNAZT ; 
GOOGLE INC. - VICTIM, 
CLOUDFLARE - VICTIM, 
- VICTIM; b6 
COMPUTER INTRUSION b7c 


Details: On June 8, 2012 Supervisory Special Agent (SSA pS 
nd Special Agent Gi a ce ee bic 
Investigator, Trust and Safety, telephone number 

onal ladanedes CT snd | ;worporare 

Counsel, at their place of employment, Google Inc., 1965 

Charleston Road, Mountain View, California fter being advised 

of the identity of the interviewing agenes|< | provided the 

following information: 

[__jaavisea that the information being provided by 3 


Google was in response to the subjects who compromised Googe 


Accounts belonging to the company CloudFlare and their 
ee that CloudFlare had also discussed 
this matter publicly on its blog. It appeared that on June 1, 
2012, the subjects compromised the 
operated by 
secondar 


ersonal Google Account 
which was listed as the 
s Google Apps account 

The subjects used their access to the 


Synopsis: To open case and subfiles. | 
UNCLASSIFIED 
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UNCLASSIFIED 


To: : San Francisco 
Re: 12/06/2011 


account to obtain access to the 
account, which was an administrator for 
cloudflare.com's Google Apps account. 


stated that the subjects compromised the 
account by initiating Google's account recovery 
procedures for the account. One of the account recovery options 
was to receive a voice call to a recovery telephone number that 
the user had previously associated with the account. The voice 
call provides the user with a unique code that can be used to 
regain access to the account. 


According to CloudFlare's blog post, the subjects 
instructed Google's system to send a voice call to the cell phone 


liste recovery number on the account, 
According to on his blog, the voicemail 
associated with the telephone number was 
compromised. also mentioned that he received an incoming 
call on his cell phone from telephone number The 
Google records showed that telephone number was 
associated with the subjects. advised that the subjects 
placed a call from to s cell phone shortly 


before the incoming voice call from Google's account recovery 
system thereby forcing the call from Google to the compromised 
voicemail box. 


advised that once the subjects obtained access to 
account, the subjects attempted to lock 

€ account by changing the password, secondary 
email address, a ecovery telephone number on the account. 
The subjects oe mmaaeasy be for control of the account until 


the 


Google staff disabled the account and provided access to the 
account back to 


stated that while the subjects had access to the 
account, they used that access to compromise 

t by requesting that a password 
be sent to the secondary 
email account, 
the account was configured to use Google's 
2-step verification feature. However, a now-fixed flaw in the 
account recovery flow for Google Apps accounts allowed the 


subjects to bypass 2-step verification and compromise the 
Co pecourt 
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To: Cyber From: San Francisco 
Re: [] 12/06/2011 


Once the subjects had access tolL.___s Google Apps 


account, they used that access to_compromise other CloudFlare 
Google Apps accounts, including According to 
CloudFlare, the subjects used théir accéss to modify proxy 


settings for CloudFlare published two blog posts about 
the incident. said the blo osts could befound at 


advised that Google's investigation found that 
the subjects may have compromised other Google Accounts, in 
addition to the / CloudFlare accounts. In some 
cases, the subjects made unsuccessful recovery claims on Gmail 
accounts. 


It is requested that the following subfiles be opened 
and assigned to sat] 


GJ Grand Jury Materials 
1AGI Grand Jury 1A Materials 
In view of the above, it is requested that a new 
matter be opened and assigned to sal] 
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RAISES 


U.S. Department of Justice 


Federal Bureau of Investigation 


bTE 


In Reply, Please Refer t 450 Golden Gate Avenue, 
File No. San Francisco, California 94102 
(415) 553-7400 


June 13, 2012 


USA Melinda L. Haag 

United States Attorney 
Northern District of California 
450 Golden Gate Avenue 

San Francisco, California 94102 


atten: ausa[____] be 
San Jose United States Attorney's Office b7C 


UNSUB(S), 
UGNAZT ; 
GOOGLE INC. - VICTIM, 
CLOUDFLARE - VICTIM, 
- VICTIM; b6 
COMPUTER INTRUSION b7c 


Dear USA Haag: 
In June of 2012, the San Francisco Division received 


information from Google, Inc. regarding an investigation 
involving a group of individuals who compromised various Google 


Accounts, including accounts that belonging to the company 

CloudFlare and Se Google also stated b6 
that CloudFlare posted information regarding the compromise on b7C 
their blog. 


CASE PREDICATION 


On approximately June 1, 2012, unknown indivi 1(s) 
compromised the personal Google Account operated yo bé6 
ro which was listed as the secondary email on b7c 
s Google Apps account . The 
subjects used their access to the account to 
obtain access to the account, which was an 


administrator for cloudflare.com's Google Apps account. 


Google informed the FBI that the subjects compromised 
the account by initiating Google's account b6 
recovery procedures for the account. One of the account recovery b7c 
options was to receive a voice call to a recovery telephone 
number that the user had previously associated with the account. 


The voice call provides the user with a unique code that can be 
used to regain access to the account. 


According to CloudFlare's blog post, the subjects 
instructed Google's system to send a voice call to the cell phone 


ecovery number_on the account, 

According to on his blog, the voicemail 
associated with the telephone number was 
compromised. [_____]also mentioned that he received an incoming 
call on his cell phone from telephone numbe The 
Google records showed that telephone number was 


associated with th i Google advised that the subjects 
placed a call from a cell phone shortly 
before the incoming voice call from Google's account recovery 


system, thereby forcing the call from Google to the compromised 
voicemail box. 


Google advised that once the subjects obtained access 
to the account, the subjects attempted to lock 
out of the account by changing the password, secondary 
email address, and_SMS recovery telephone number on the account. 
The subjects and[____] fought for control of the account until 
Google staff disabled the account and provided access to the 
account back to 


While the subjects had access to thel sid 


account, they used that access to compromise the 

b esting that a password 
be sent to the secondary 
Unlike the account, 
account was configured to use Google's 
2-step verification feature. However, a now-fixed flaw in the 
account recovery flow for Google Apps accounts allowed the 


subjects to bypass 2-step verification and compromise the 
Pe Jaaccount 

Once the subjects had access toL_____s Google Apps 
account, they used that access to compromise other CloudFlare 
Google Apps accounts, Gendell According to 
CloudFlare, the subjects used their access to modify proxy 
settings for[____] CloudFlare published two blog posts about 


reset link for 


Google's investigative team also discovered that the 
subjects may have compromised other Google Accounts, in addition 
to the / CloudFlare accounts. In some cases, the 
subjects made unsuccessful recovery claims on Gmail accounts. 
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The San Francisco Division has opened a full 


investigation into i ich has been assigned to 
Special Agent (SA) 


Sincerely, 


Stephanie Douglas 
Special Agent in Charge 


Supervisory 5p gent 


b6 
b7Cc 


U.S. Department of Justice 


Federal Bureau of Investigation 


In Reply, 450 Golden Gate Avenue bE 
File No. San Francisco, California 94102 


(415) 553-7400 


June 13, 2012 


USA Melinda L. Haag b6 
United States Attorney BIC 
Northern District of California 
450 Golden Gate Avenue 
San Francisco, California 94102 
Attn: ausa[ ___ 
San Jose United States Attorney's Office 
UNSUB(S), 
UGNAZI ; 
GOOGLE INC. - VICTIM, 
CLOUDFLARE - VICTIM, 
VICTIM; b6 
COMPUTER INTRUSION b7c 
Dear USA Haag: 
Pursuant to the above captioned investigation, the 
Federal Bureau of Investigation (FBI) requests that the below 
listed individuals be placed on the Federal Grand Jury 6E list, 
in as much as they may require access to Grand Jury information 
during the course of the investigation: 
bé 
b7Cc 


Sincerely, 


Stephanie Douglas 
Special Agent in Charge 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 06/15/2012 


On June 14, 2012, Special Agent 
served a Preservation Request on 


The Preservation Request requested all records and other 


A copy of the preservation request, facsimile cover page 
and facsimile verification report are attached and made a part of 
this document. 


Investigation on 06/14/2012 a’ Campbell, California 
File Date dictated not dictated 


by SA | Bl 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 
it and its contents are not to be distributed outside your agency. 
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U.S. Department of Justice 


Federal Bureau of Investigation 


In Reply, Please Refer to 450 Golden Gate Avenue 
File No. San Francisco, CA 94102 
(415)553-7400 


June 14, 2012 


RE: Preservation Request 
Dear Custodian of Records: 


e Federal Bureau of Investigation (FBI) is requesting 
that take all necessary steps to preserve for a period of 
ninety (90) days any and all records and other evidence 


includin 


Title 18, U.S.C. 88§ 2703(f£) states the following: 


(£) Requirement to preserve evidence - 


(1) In general - A provider of wire or electronic 
communication services or a remote computing service,. 
upon the request of a governmental entity, shall take 
all necessary steps to preserve records and other 
evidence in its possession pending the issuance of a 
court order or other process. 


(2) Period of retention - Records referred to in 
paragraph (1) shall be retained for a period of 90 
days, which shall be extended for an additional 90-day 
period upon a renewed request by the governmental 
entity. 


The requested information relates to an ongoing, 
official criminal investigation. It is requested that you do not 
disclose the existence of the FBI's interest into this matter 
until you are notified that the investigation has been completed. 
Failure to comply with this request may subject you to criminal 
penalties, including, but not limited to, obstruction of justice 


b7E 


b6 
b7C¢ 
b7E 


under Title 18 U.S.C. §§ 1503. As you are aware, disclosure 


could impede the investigation and interfere with the enforcement 
of law. 


Should you have any questions or ne iti 
information, please contact FBI Special Agent at 
telephone mumber[ 

Sincerely, 


Stephanie Douglas 
Special Agent in Charge 


Supervisory Special Agent 


b6 
b7c 


b6 
b7C¢ 


FD-448 
Revised 
10-27-2004 


FEDERAL BUREAU OF INVESTIGATION 
FACSIMILE COVER SHEET 


PRECEDENCE 
C Immediate C Priority @ Routine 
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Name of Office: Eacsimile Number: Date: 

Eds /a4y2orz b7E 
Attn: Telephone Number: 
Online Services Custodian of Records 

FROM 
Name of Office: Number of Pages: (including cover) 
3 
Origin Originator's Facsimile Number: 
SU] |a08-558-3977 b6 
b7C 

Approved: ; 


DETAILS 


Subject: 
Preservation Request 


* 


+ Special Handling Instructions: 


b7C 


Brief Description of Communication Faxed: 


WARNING 
Information attached to the cover sheet is U.S. Government Property. If you are not the intended recipient of this information disclosure, 


reproduction, distribution, or use of this information is prohibited (18.USC, § 641). Please notify the originator or local FBI Office 
immediately to arrange for proper disposition, 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 06/15/2012 


b6 


14, 2012, Spec — 
b7E 
The Preservation Request requested all records and other 
evidence be preserved for 90 days for 
b6 
b7c 
b7E 


A copy of the preservation request, facsimile cover page 
and facsimile verification report are attached and made a part of 
this document. 


Investigation on 06/14/2012 at Campbell, California 


: b7E 

File Date dictated not dictated 
by SA b6 
b7c 


This document contains neither recommendations nor conclusions of the FBL It is the property of the FBI and is loaned to your agency; 
it and its contents are not to be distributed outside your agency. 


U.S. Department of Justice 


Federal Bureau of Investigation 


In Reply, Please Refer to 450 Golden Gate Avenue 
File No. San Francisco, CA 94102 
(415) 553-7400 


June 14, 2012 


RE: Preservation Request 
Dear Custodian of Records: 

e Federal Bureau of Investigation (FBI) is requesting 
that take all necessary steps to preserve for a period of 
ninety (9 days any and all records and other evidence 
includin but not limited to 


Title 18, U.S.C. §§ 2703(£) states the following: 


(£) Requirement to preserve evidence - 


(1) In general - A provider of wire or electronic 
communication services or a remote computing service, 
upon the request of a governmental entity, shall take 
all necessary steps to preserve records and other 
evidence in its possession pending the issuance of a 
court order or other process. 


(2) Period of retention - Records referred to in 
paragraph (1) shall be retained for a period of 90 
days, which shall be extended for an additional 90-day 
period upon a renewed request by the governmental 
entity. 


bTE 


b7E 


b6 
b7c 
b7E 


” 


ae ee 


The requested information relates to an ongoing, 
official criminal investigation. It is requested that you do not 
disclose the existence of the FBI's interest into this matter 
until you are notified that the investigation has been completed. 
Failure to comply with this request may subject you to criminal 
penalties, including, but not limited to, obstruction of justice 
under Title 18 U.S.C. §§ 1503. As you are aware, disclosure 
could impede the investigation and interfere with the enforcement 
of law. 


Should you have any questions or need_additional 


information, plea pecial Agent[ scl b6 
telephone number bic 
Sincerely, 


Stephanie Douglas 

Special Agent in Charge 
b6 
b7C 


Su 1 Agent 
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CLASSIFICATION 


C Top Secret C Secret C Confidential C Sensitive @ Unclassified 


Facsimile Number: 


TO 


Name of Office: Date: 


06/14/2012 


Attn: 
Compliance Team 


FROM 


Name of Office: 


Originator's Facsimile Number: 
408-558-3977 


DETAILS 


Subject: 
Preservation Request 


Special Handling Instructions: 


Brief Description of Communication Faxed: 


WARNING 
Information attached to the cover sheet is U.S. Government Property. If you are not the intended recipient of this information disclosure, 
reproduction, distribution, or use of this information is prohibited (18.USC, § 641). Please notify the originator or local FBI Office 
immediately to arrange for proper disposition. 
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DATE, TIME 
FAX NO. /NAME 
DURATION 
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RESULT 

MODE 
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Pee 


FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 06/15/2012 


On June 14, 2012, Special Agent (SA) 
served a Preservation Request on 


The Preservation Request requested all records and other 


cn aoe for 90 days for 


A copy of the preservation request, facsimile cover page 
and facsimile verification report are attached and made a part of 
this document. 


Investigation on 06/14/2012 at Campbell, California 
File # Date dictated not dictated 


by SA | Py, 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 
it and its contents are not to be distributed outside your agency. 
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U.S. Department of Justice 


Federal Bureau of Investigation 


In Reply, Please:Refer'to 450 Golden Gate Avenue 
File No. San Francisco, CA 94102 
(415)553-7400 


June 14, 2012 


RE: Preservation Request 
Dear Custodian of Records: 
that 


nine 
includin 


take all necessary steps to preserve for a period of 


The Federal Bureau of Investigation (FBI) is requesting 
a days any and all r n her idence 


Title 18, U.S.C. §8§ 2703(£) states the following: 


(£) Requirement to preserve evidence - 


(1) In general - A provider of wire or electronic 
communication services or a remote computing service, 
upon the request of a governmental entity, shall take 
all necessary steps to preserve records and other 
evidence in its possession pending the issuance of a 
court order or other process. 


(2) Period of retention - Records referred to in 
paragraph (1) shall be retained for a period of 90 ' 
days, which shall be extended for an additional 90-day 
period upon a renewed request by the governmental 
entity. 


b7E 


b6 
b7c 
b7E 


The requested information relates to an ongoing, 
official criminal investigation. It is requested that you do not 
disclose the existence of the FBI's interest into this matter 
until you are notified that the investigation has been completed. 
Failure to comply with this request may subject you to criminal 
penalties, including, but not limited to, obstruction of justice 
under Title 18 U.S.c. §§ 1503. As you are aware, disclosure 
could impede the investigation and interfere with the enforcement 
of law. 


Should you have any questions or need additional 
information, please contact FBI Special Agent{ sit 
telephone number 


Sincerely, 


Stephanie Douglas 
Special Agent in Charge 
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Date: 
06/14/2012 
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Attn: 
Custodian of Records 
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Name of Office: Number of Pages: (including cover) 
3 
Originator's Facsimile Number: 


408-558-3977 


Originator's Name: 


Originator's Telephone Number: 


Approved: 


DETAILS 


Subject: 
Preservation Request 


Special Handling Instructions: 


Please contacd for any questions — Pe 


Brief Description of Communication Faxed: 


WARNING 
Information attached to the cover sheet is U.S. Government Property. If you are not the intended recipient of this information disclosure, 
reproduction, distribution, or use of this information is prohibited (18.USC, § 641). Please notify the originator or local FBI Office 
immediately to arrange for proper disposition. 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 06/15/2012 


On June 14, 2012, Special Agent 
served a Preservation Request on 


The Preservation Request requested all records and other 
evidence be preserved for 90 days for 


Investigation on 06/14/2012 at Campbell, California 


File CY ee Date dictated not dictated 
by sal | 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 
it and its contents are not to be distributed outside your agency. 
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Continuation of FD-302 of ,On 06/14/2012 , Page 2 
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A copy of the preservation request, facsimile cover page 
and facsimile verification report are attached and made a part of 
this document. : 


U.S. Department of Justice 


Federal Bureau of Investigation 


In Reply, Please Refer to 450 Golden Gate Ave. 

File No. San Francisco, CA 94102 
(415) 553-7400 
June 14, 2012 


b7E 
Attention: Custodian of Records 
Re: Preservation request 
Dear Legal Compliance Department: 
Pursuant to Title 18, United States Code, Section 
2703(£) you are hereby directed to take all steps necessary to 
preserve all records and other evidence in the possession of 
or the following: 
b6 
b7Cc 


bTE 


* 


b6 
b7Cc 
b7E 
Such records and evidence include, but are not limited 
to b7E 


Order requiring the production of all information (including 
content) pursuant to the Electronic Communication Transactional 
Records Act, 18 U.S.C. § 2701, et seq. Under Section 2703(f£), 
you are required to preserve these items for a period of 90 days. 
This period is subject to renewal. 


Please be advised that your failure to comply with this 
request may subject you to criminal penalties, including, but not 
limited to, obstruction of justice under 18 U.S.C. § 1503, et 
seq. 


Because this request in being made pursuant to an 
official criminal investigation, you are requested not to 
disclose this request, or its contents to anyone. 


If you have any questions or need additional 


information, pl ecial Agenth ———“C—Cidt cat b6 
telephone numbe or fax number (408)558-3977. bic 


Sincerely, 


Stephanie Douglas 
Special Agent in Charge 


b6 
b7C 


This request is made in anticipation of an appropriate 
Supervisory Special Agent 
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Custodian of Records 
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Name of Office: Number of Pages: (including cover) 
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Approved: : bic 


DETAILS 


Subject: 
Preservation Request 


Special Handling In 


Please contact {for any questions at SS ——| oe 


Brief Description of Communication Faxed: 


WARNING 


Information attached to the cover sheet is U.S. Government Property. If you are not the intended recipient of this information disclosure, 
reproduction, distribution, or use of this information is prohibited (18.USC, § 641). Please notify the originator or local FBI Office 
immediately to arrange for proper disposition. 
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DATE, TIME 
FAX NO. /NAME 
DURATION 
PAGE <S> 
RESULT 

MODE 


TIME : @6/14/2012 16:21 
NAME : CYBER CRIM 
FAM : 4685583977 


SER.# : BROF@J169395 


b7E 


84” 
OK 
STANDARD 


; : © 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 06/18/2012 


On June 11, 2012, Federal _Bureau_of Investigation (FBI) 


Staff Operations Specialist (SOS) CO Cidccondtucted open b6 
source searches and reviewed subscriber information provide b b7C 
Google on i i : 
b6 
b7c 
un 
i 
é 
a 
Investigation on 06/18/2012 at Campbell, California 
b7E 
File # Date dictated 
by b6 
b7c 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 
it and its contents are not to be distributed outside your agency. 


: S & 
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Continuation of FD-302 of ,On 06/18/2012 __,Page 2 
b6 
b7¢c 
b6 
b7C 
The = Reena email addres isted 
f Y. | CC™~—“CCCC eons tol = ssp 
‘" gource searches confirmed bothL____——(‘(OC‘i'S Twitter 
% accounts were compromised on June 3, 2012 by UNDERGROUND NAZI 
HACKTIVIST GROUP (UGNAZI). UGNAZI tweeted telephone number 
tol ds _ followers. In addition, UGNAZI_changed the 
SMS _ telephone number onl —Ssd 3 email account to eases 
b6 


b7C 


¢ ] 
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Continuation of FD-302 of ,On 06/18/2012 _ ,Page 3 
b6 
b7C 
b6 
TC T™rTTT.. CC Tbe long tol (PROTECT IDENTITY) eo 
date of birth social security number] , 
b6 


7 ® 


* FD-302a (Rev. 10-6-95) 


| 


Continuation of FD-302 of ,On 06/18/2012 ,Page 4 _ 


Information could not be located for account 
however,[ i and SMS 
s identified as belonging to account 
ACS searches were negative concerning 


Accou 


[account 


located on 
negative. 


is associated with[ 
No other information cou e 


or [ - ACS searches were 


b7E 


' b7C 


b7C 


b7¢ 


b7C 


b6 
b7C 


b6 


e 
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Continuation of FD-302 of 


No — source information could be located for account 


:On 06/18/2012 __,Page 


ACS searches were negative. 


b7E 


b6 
b7c 


b6 
b7Cc 


From: LF) (FBI) 


Sent: 2012 9:52 AM 

To: ) (FBI) 

Ce: (iF) (FBI) 

Subject: IC3 complaint on UGNazi and email address[—_|@gmail.com 


Classification: UNCLASSIFIED 


bTE 


RECORD: . 


On 06/27/2012, MP forwarded the attached complaint to sq with the New York field b6 
office and S and SA with the San Francisco field office. ~ oye 


The complaint is on the Anonymous splinter group UGNazi and email address[_——_f@ gmail.com. 


The complaint was filed with the IC3 on 06/26/2012 i a [- telephone a 
number|_————_and email addres mail.com reported that his gmail account was 


compromised on 05/12/2012 and the subjects used it to take over 23 domains he owns. He reported the subjects’ 
domain as ugnazi.com and email address as[_____ |@gmail.com. 


{_——Feparted he was able to recover 17 of the domains. One of the domains he was not able to recover was bé6 
which he has owned for the last 10 years and has received numerous five figure offers for. Therefore, he 
reported he lost $50,000. ___|stated the subjects transferred his domain from GoDaddy to Internet.bs. He stated 
he and GoDaddy have repeatedly attempted to contact Internet.bs, but they refuse to investigate[___—_—i believes 
Internet.bs is involved with the subjects. 


purportedly hijacked from another victim. 


[_ believes the sl are targeting high value domains since they went after hif —_ftomain and they es 


A search of ACS on mail.com found that this email address was mentioned in San Francisco’s cas _b6 
which was opened on 06/12/2012. Their case is on UGNazi, and the victims ar ae 


06/14/2012, San Francisco served a preservation letter t 


and many others. The case file also mentioned s gmail account. The IC3 received a complaint on 6/4/12 
from reported aa 
[}s twitter and gmail accounts were hacked b The complaint was 


request. 


b7E 
New York also has an open case on von 


Recipients were requested to advise to writer if the information is utilized in their case. 


; e e 
f ’ 


’ 


~ f 
IC3 Automatch number 120402-224175. 
Management & Program Analyst 


Cyber Division 
Internet Crime Complaint Center (C3) 


b7C 


